Privacy Policy

Controller

Petterik Oy (Business ID 3102728-1) is the controller for personal data processed through the KisaPlay website.

Contact details

Petterik Oy, Petteri Kolehmainen, Lekkerikallio 5, 02400 Kirkkonummi, Finland. Email: yhteys@kisaplay.com

Data protection contact

For questions about privacy, personal data, or the exercise of your data protection rights, you can contact: yhteys@kisaplay.com

What this policy covers

This Privacy Policy explains how we process personal data when you create an account, join or create a team, submit sports event score predictions, participate in rankings and prize competitions, ask to receive new competition notifications, contact us, or otherwise use the website.

Who may use the service

The service is intended only for persons aged 18 or over. We do not knowingly offer the service to minors. If we learn that a person under 18 has created an account, we may remove the account and delete the related data unless retention is required by law or for the handling of a concrete issue.

Personal data we process

We process the following personal data:

• email address;
• nickname and profile picture;
• team name;
• submitted score predictions and related timestamps;
• points, rankings, standings, competition history, and team participation data;
• your voluntary consent to receive new competition notification emails and timestamps for giving or withdrawing that consent;
• an account-level daily usage summary for signed-in users, such as active days and page view counts without page paths;
• support messages or other communications sent to us;
• records relating to rule enforcement, abuse prevention, or dispute handling;
• technical data required for the operation and security of the service, such as session information, IP address, and server or security logs.

If you win a prize, we may also process prize-related information. As a rule, we will share the winner's email address with the named Finnish sponsor so that the sponsor can contact the winner directly. If additional information is needed for prize delivery or legal or tax-related handling, the sponsor will normally collect that information from the winner directly under the sponsor's own privacy practices.

Purposes and legal bases

We process personal data for the following purposes:

• to create and manage your account, enable login, and provide the service;
• to organise prediction competitions, record your predictions, calculate rankings, maintain team standings, and show competition results;
• to prevent cheating, fraud, abuse, and security incidents, and to protect the integrity of the service;
• to respond to support requests and handle complaints or disputes;
• to monitor service usage and retention trends with account-level daily summaries without page paths;
• to send email about new KisaPlay competitions only if you have given separate consent;
• to verify eligibility for prizes and enable prize fulfilment;
• to comply with applicable law and to establish, exercise, or defend legal claims.

Our legal bases are performance of a contract, where processing is necessary to provide the service you requested; legitimate interests, where processing is necessary to keep the service secure and fair, prevent misuse, investigate suspicious activity, and handle claims or disputes; legal obligation, where we must process data to comply with Finnish or other applicable law; and consent, where we send voluntary new competition notifications.

We do not use your registration data or competition data for sponsor marketing by default. If we ever introduce optional sponsor marketing, it will be based on separate consent and not on hidden or bundled wording.

Public rankings and visibility

Because rankings and team competition are core parts of the service, your nickname, profile picture, team name, predictions, points, and standings may be visible to other users and, where relevant competition pages are public, to site visitors. We do not publish your real name by default in rankings.

Prize sponsors and recipient roles

If a competition has a sponsor-funded prize, the sponsor will be identified in the relevant competition page, prize notice, or campaign terms. For prize delivery and possible tax-related handling, the sponsor will normally act as a separate controller for the winner data it processes directly. We may disclose the winner's email address, and only other data if necessary, to the sponsor in Finland so the sponsor can contact the winner and complete the prize process.

Recipients of data

We may disclose personal data to:

• Finnish hosting or technical service providers acting on our instructions;
• Finnish security or maintenance providers where necessary for operating the website;
• Resend (resend.com) for routing login, registration, and voluntarily subscribed competition notification emails;
• the relevant Finnish prize sponsor, only where necessary for prize fulfilment or prize-related legal handling;
• authorities, advisers, or courts where required by law or necessary in relation to legal claims.

We do not sell personal data.

Data location and transfers

The core application data is hosted and processed in Finland. Login, registration, and voluntarily subscribed competition notification emails are routed through Resend (resend.com). Resend's EU sending region is in use, and emails are sent from Ireland.

According to Resend's own documentation, however, the sending region does not determine the location of all account, log, API, or metadata, and Resend may process such data in the United States. Any transfers outside the EEA are handled under applicable data protection safeguards and contractual arrangements.

If our setup changes materially in the future, we will update this Privacy Policy before that change takes effect.

Cookies and similar technologies

We use only strictly necessary first-party cookies and similar technologies required to operate the website, keep users signed in, maintain session security, remember basic service settings, balance server load, and detect abuse. General site usage is also measured with an anonymous, cookie-free visitor counter that does not store IP addresses, user agents, page paths, or persistent browser identifiers. For signed-in users, we record an account-level daily usage count through the existing login session without page paths or separate analytics identifiers. We do not use advertising cookies, social media tracking cookies, or third-party tracking technologies. Please also see our Cookie Notice.

Retention

We keep personal data only for as long as necessary for the purposes described above:

• account and profile data: while your account is active;
• new competition email notification consent: while the consent remains active; after withdrawal, we keep only limited data necessary to honour the withdrawal and avoid mistaken sends;
• inactive accounts: if your account has had no login and no prediction activity for 12 consecutive months, we may remove the account and delete or anonymise related data within a reasonable deletion cycle;
• competition and ranking data linked to an active account: while needed to operate current and recent competitions and to maintain the service history available to the user;
• competition and ranking data after inactivity-based deletion: deleted or anonymised after account removal unless longer retention is necessary for fraud prevention, dispute handling, or legal claims;
• support, security, and abuse-handling records: normally for up to 12 months, unless a longer period is needed because of an ongoing issue or claim;
• server and security logs: typically for 30 to 90 days, unless needed longer for incident investigation;
• prize-related records held by us: only as long as needed to confirm the winner, document the disclosure to the sponsor, and handle any related issue.

We may retain limited data longer where required by law or where necessary to establish, exercise, or defend legal claims.

Security

We implement appropriate technical and organisational measures to protect personal data. These may include encrypted connections, access controls, role-based permissions, logging, backups, software updates, limited administrator access, and procedures for handling security incidents. Access to personal data is restricted to persons who need it for their tasks.

Your rights

Subject to the GDPR and applicable law, you have the right to:

• obtain information about the processing of your personal data;
• access your personal data;
• request rectification of inaccurate or incomplete data;
• request erasure in certain situations;
• request restriction of processing in certain situations;
• receive the personal data you have provided to us in a structured, commonly used, and machine-readable format where the right to data portability applies;
• object to processing based on legitimate interests on grounds relating to your particular situation;
• lodge a complaint with a supervisory authority.

Where processing is based on consent, such as new competition email notifications, you have the right to withdraw that consent at any time without affecting earlier lawful processing. You can unsubscribe through the email unsubscribe link or from your profile. To exercise other rights, contact us at yhteys@kisaplay.com.

Complaint to the supervisory authority

If you believe that our processing of personal data infringes data protection law, you have the right to lodge a complaint with the Office of the Data Protection Ombudsman in Finland.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The current version will always be available on the website together with its effective date. If changes are material, we will provide appropriate notice.